MoreConvert Wishlist for WooCommerce Security & Risk Analysis

The "smart-wishlist-for-more-convert" plugin exhibits a mixed security posture. While it demonstrates good practices in output escaping (97% properly escaped) and a significant portion of its SQL queries utilize prepared statements (64%), there are notable areas of concern. The presence of 31 AJAX handlers, with 4 lacking authentication checks, represents a significant attack surface. Furthermore, the analysis identified 5 high-severity taint flows, indicating potential for severe vulnerabilities if not properly addressed. The plugin's vulnerability history reveals a pattern of common web security flaws, including Cross-site Scripting, SQL Injection, and authorization issues, with a recent high-severity vulnerability from June 2025. Although no currently unpatched CVEs are listed, the historical prevalence of these vulnerabilities, combined with the identified taint flows and unprotected AJAX handlers, suggests a risk of new vulnerabilities emerging or existing ones being exploitable.